#!/usr/bin/env bash
# Sends sanitized health results through the host's locally provisioned SMTP
# credentials. The config is intentionally excluded from Ansible/Git.
set -uo pipefail
config='{{ email_alert_config_path }}'
result='/var/lib/vps-health/latest.json'
state='{{ email_alert_state_path }}'
[[ -r "$config" && -r "$result" ]] || exit 0
# shellcheck source=/dev/null
source "$config"
: "${SMTP_URL:?missing SMTP_URL in server-side alert config}"
: "${ALERT_TO:?missing ALERT_TO in server-side alert config}"
status="$(python3 -c 'import json; print(json.load(open("'"$result"'"))["status"])')"
fingerprint="$(sha256sum "$result" | cut -d' ' -f1)"
previous="$(cat "$state" 2>/dev/null || true)"
now="$(date +%s)"
last_time="${previous%%:*}"; last_fp="${previous#*:}"
if [[ "$status" =~ ^(critical|unknown)$ ]] && [[ "$fingerprint" != "$last_fp" || $((now-${last_time:-0})) -ge {{ email_alert_repeat_hours }}*3600 ]]; then
  subject="[${status}] VPS health $(hostname -f 2>/dev/null || hostname)"
  curl --fail --silent --show-error --url "$SMTP_URL" --mail-rcpt "$ALERT_TO" --upload-file <(printf 'To: %s\nSubject: %s\nContent-Type: application/json\n\n%s\n' "$ALERT_TO" "$subject" "$(cat "$result")")
  printf '%s:%s\n' "$now" "$fingerprint" > "$state"
elif [[ "$status" =~ ^(ok|warning)$ ]]; then
  subject="[${status}] daily VPS health $(hostname -f 2>/dev/null || hostname)"
  curl --fail --silent --show-error --url "$SMTP_URL" --mail-rcpt "$ALERT_TO" --upload-file <(printf 'To: %s\nSubject: %s\nContent-Type: application/json\n\n%s\n' "$ALERT_TO" "$subject" "$(cat "$result")")
fi